Enterprise Code Signing Certificates: Best Practices Guide

Why Code Signing Matters

Code signing is the process of digitally signing software to verify its authenticity and integrity. For enterprises, code signing is essential for:

• Trust: Users and systems can verify software comes from a trusted source
• Integrity: Detect if code has been tampered with
• Compliance: Meet regulatory requirements for software distribution
• Security: Prevent malware injection into the software supply chain

The Risk of Unsigned Code

Without proper code signing:

• Operating systems display security warnings
• Enterprise software deployment is blocked
• App stores reject submissions
• Supply chain attacks go undetected

Types of Code Signing Certificates

Standard Code Signing

• Signs executables, DLLs, drivers
• Private key stored on developer machines
• Suitable for internal or limited distribution

EV Code Signing

• Extended Validation with hardware key requirement
• Private key must be on HSM or hardware token
• Immediate SmartScreen reputation for new publishers
• Required for Windows kernel-mode drivers

Apple Code Signing

• Developer ID for macOS distribution
• iOS distribution certificates
• Mac Installer certificates
• Notarization requirements

Java Code Signing

• JAR signing for Java applications
• Applet signing (legacy)
• Android APK signing

Enterprise Code Signing Architecture

Centralized Signing Service

Implement a centralized signing infrastructure:

1. Signing Server: Dedicated secure server for signing operations
2. HSM Integration: Hardware Security Module for key protection
3. API Interface: RESTful API for CI/CD integration
4. Audit Logging: Complete audit trail of all signing operations
5. Access Control: Role-based access to signing keys

CI/CD Integration

Integrate code signing into build pipelines:

yaml
1# Example GitHub Actions workflow
2- name: Sign Windows Executable
3  uses: tigertrust/code-signing-action@v1
4  with:
5    api-key: ${{ secrets.TIGERTRUST_API_KEY }}
6    file-path: build/myapp.exe
7    certificate-name: production-signing-cert
8    timestamp-url: http://timestamp.digicert.com

Key Management

Secure key management is critical:

HSM Requirements

• FIPS 140-2 Level 2 or higher
• Physical tamper protection
• Access control and audit logging
• Key backup and recovery procedures

Key Hierarchy

• Root signing keys (offline, highest security)
• Intermediate/issuing keys (operational use)
• Team or project-specific keys (delegated authority)

Code Signing Best Practices

Protect Private Keys

• Never store private keys on developer machines
• Use HSMs for all production signing keys
• Implement strong access controls
• Regular key rotation (annually or per major version)

Implement Timestamping

Always timestamp signatures:

bash
1signtool sign /sha1 THUMBPRINT /tr http://timestamp.digicert.com /td sha256 /fd sha256 myapp.exe

Benefits of timestamping:

• Signatures remain valid after certificate expires
• Long-term verification of signed code
• Compliance requirement for many use cases

Use Strong Algorithms

• SHA-256 or higher for hashing
• RSA 2048-bit minimum, 4096-bit recommended
• ECDSA P-256 or P-384 for modern implementations

Separate Keys by Purpose

• Development/test signing keys
• Production signing keys
• Different keys per product or team
• Separate keys for different platforms

Code Signing Workflow

Development Phase

1. Developers build and test locally
2. Internal builds signed with development certificate
3. QA validation on signed development builds

Pre-Release

1. Build artifacts from clean environment
2. Security scan before signing
3. Approval workflow for production signing
4. Sign with production certificate
5. Notarize for Apple platforms

Distribution

1. Verify signatures before distribution
2. Store signed artifacts securely
3. Distribute through authorized channels
4. Monitor for certificate revocation

Platform-Specific Considerations

Windows Code Signing

powershell
1# Sign with signtool
2signtool sign /sha1 THUMBPRINT /tr http://timestamp.digicert.com /td sha256 /fd sha256 myapp.exe
3
4# Verify signature
5signtool verify /pa /v myapp.exe

macOS Code Signing

bash
1# Sign application
2codesign --deep --force --verify --verbose --sign "Developer ID Application: Company Name" MyApp.app
3
4# Notarize for distribution
5xcrun notarytool submit MyApp.dmg --keychain-profile "notarization" --wait
6
7# Staple notarization ticket
8xcrun stapler staple MyApp.dmg

Linux Code Signing

bash
1# GPG signing
2gpg --armor --detach-sign myapp.tar.gz
3
4# Verify
5gpg --verify myapp.tar.gz.asc myapp.tar.gz

Compliance and Audit

Audit Trail Requirements

Maintain records of:

• Every signing operation (who, what, when)
• Key usage and access
• Certificate lifecycle events
• Policy violations and exceptions

Compliance Standards

Code signing supports compliance with:

• PCI DSS: Secure software development
• SOC 2: Change management controls
• FDA 21 CFR Part 11: Electronic signatures for medical devices
• ISO 27001: Information security management

Incident Response

Certificate Compromise

If a signing certificate is compromised:

1. Immediately revoke the certificate
2. Identify all software signed with compromised key
3. Resign with new certificate
4. Notify affected customers
5. Conduct root cause analysis

Malware Signed with Valid Certificate

If malware is discovered signed with your certificate:

1. Investigate how signing occurred
2. Revoke certificate if necessary
3. Review access controls and logs
4. Implement additional safeguards

Conclusion

Enterprise code signing certificates are essential for secure software distribution and supply chain security. By implementing centralized signing infrastructure, proper key management, and robust CI/CD integration, organizations can ensure their software is trusted and secure.

TigerTrust provides enterprise code signing capabilities as part of our comprehensive certificate lifecycle management platform, including HSM integration, CI/CD automation, and complete audit logging.